What is CVE-2024-27631?

CVE-2024-27631 is a medium-severity vulnerability in GNU Savane, classified under Cross-Site Request Forgery (CSRF). CVSS score: 6.0/10. Published 2024-04-08.

How severe is CVE-2024-27631?

Medium severity. CVSS v3 base score is 6.0 out of 10.

Is CVE-2024-27631 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

CSRF in GNU Savane

CVE-2024-27631

Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php

Vulnerability class: CSRF (Cross-Site Request Forgery)

Published 2024-04-08 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L.

EPSS exploit prediction

EPSS: 0.004 (33.5th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 34th percentile — 33.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

GNU Savane

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

Public proof-of-concept exploits

References

git.savannah.nongnu.org/cgit/administration/savane.git/commit/ (Patch)
medium.com/@allypetitt/how-i-found-3-cves-in-2-days-8a135eb924d3 (Exploit, Third Party Advisory)
github.com/ally-petitt/CVE-2024-27631 (Exploit, Third Party Advisory, Mitigation)

Frequently asked questions

What is CVE-2024-27631?: CVE-2024-27631 is a medium-severity vulnerability in GNU Savane, classified under Cross-Site Request Forgery (CSRF). CVSS score: 6.0/10. Published 2024-04-08.
How severe is CVE-2024-27631?: Medium severity. CVSS v3 base score is 6.0 out of 10.
Is CVE-2024-27631 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.